From 102b1a064a9b145e56556e22b18b19c624538d94 Mon Sep 17 00:00:00 2001
From: Romain Lespinasse <romain.lespinasse@gmail.com>
Date: Mon, 20 Feb 2023 11:57:12 +0100
Subject: [PATCH] fix: use github.head_ref env var as trusted input

---
 action.yml | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/action.yml b/action.yml
index ef5e166..6c540ac 100644
--- a/action.yml
+++ b/action.yml
@@ -26,6 +26,7 @@ runs:
         INPUT_SLUG_MAXLENGTH: ${{ inputs.slug-maxlength }}
         INPUT_SHORT_LENGTH: ${{ inputs.short-length }}
 
+    # From Environment Variables
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY
@@ -48,30 +49,25 @@ runs:
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Specific values
+    # From Specific values
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_EVENT_REF
         value: ${{ github.event.ref }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-
-    # Calculated values
-    - id: get-github-ref-name
-      run: |
-        refname="${{ github.head_ref || github.ref_name }}"
-        if [ -f "$GITHUB_OUTPUT" ]; then
-          echo "github-ref-name=${refname}" >> "$GITHUB_OUTPUT"
-        else
-          echo "::set-output name=github-ref-name::${refname}"
-        fi
-      shell: bash
     - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF_NAME
-        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
+        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
+        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
+      env:
+        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
+        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}
+
+    # From Calculated values
     - id: get-github-repository-owner-part
       run: |
         ownerpart=$(echo $GITHUB_REPOSITORY | cut -d/ -f1)
@@ -103,7 +99,7 @@ runs:
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Short
+    # From sha
     - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_SHA